Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | Misconfiguration and Insecure Design | Low | 2016-09-20 | – | 154 |
| Takeover of hackerone.engineering via GithubAnalysed#2085260 | Valid | Access Control | Medium | 2023-07-31 | – | 135 |
| Subdomain takeover at info.hacker.oneAnalysed#202767 | Valid | Access Control | Low | 2017-03-27 | – | 134 |
| Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widgetAnalysed#1598347 | Valid | Cross-site Scripting | Medium | 2023-03-10 | – | 122 |
| Subdomain takeover of resources.hackerone.comAnalysed#863551 | Valid | No weakness recorded | Low | 2020-05-15 | $500 | 95 |
| Subdomain takeover #2 at info.hacker.oneAnalysed#209004 | Valid | Access Control | Low | 2017-04-28 | – | 78 |
| Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeoverAnalysed#514451 | Valid | Server-Side Request Forgery | None | 2019-04-04 | $500 | 68 |
| Takeover of hackerone.engineering via MediumAnalysed#2709660 | Valid | Authentication | Low | 2024-11-14 | – | 63 |
| Subdomain takeover #3 at info.hacker.oneAnalysed#217358 | Valid | Access Control | Low | 2017-06-21 | – | 58 |
| Subdomain takeover #4 at info.hacker.oneAnalysed#220002 | Valid | Access Control | Low | 2017-06-21 | – | 50 |
| Dangling cloud instance at vpn.inverselink.comAnalysed#1112679 | Valid | Input Validation and Logic | Low | 2021-03-11 | $500 | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.